956b7a76a15eeaac0ac9378bb792c4f6f707df3b46a02a207c3df1b0bdf7ad19

Analysis

max time kernel
84s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5ad15a9115a60f15b7796bc717a471d.exe
Size

31KB
MD5

a5ad15a9115a60f15b7796bc717a471d
SHA1

b78f6e55a2248f9971fcc4237d92f3948703bbbd
SHA256

956b7a76a15eeaac0ac9378bb792c4f6f707df3b46a02a207c3df1b0bdf7ad19
SHA512

8c937291f4781da0326e502e285014c49dd3c6b4422728f71d31368979f824d0aee667a5e726da9e26d8463fdb5b6ed0e83a6a9650fa3fae424ad3ec737f1377
SSDEEP

768:m1ijxm6f8uZ5KgAqERC9tUgbhq7xq0Wy37w3ICcx:uAxm6fH9mRC9tRe7Wy37w3ICcx

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ident.me

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe
1200	a5ad15a9115a60f15b7796bc717a471d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	a5ad15a9115a60f15b7796bc717a471d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2028	1200	a5ad15a9115a60f15b7796bc717a471d.exe	84
PID 1200 wrote to memory of 2028	1200	a5ad15a9115a60f15b7796bc717a471d.exe	84
PID 1200 wrote to memory of 2028	1200	a5ad15a9115a60f15b7796bc717a471d.exe	84
PID 1200 wrote to memory of 5060	1200	a5ad15a9115a60f15b7796bc717a471d.exe	86
PID 1200 wrote to memory of 5060	1200	a5ad15a9115a60f15b7796bc717a471d.exe	86
PID 1200 wrote to memory of 5060	1200	a5ad15a9115a60f15b7796bc717a471d.exe	86

C:\Users\Admin\AppData\Local\Temp\a5ad15a9115a60f15b7796bc717a471d.exe
"C:\Users\Admin\AppData\Local\Temp\a5ad15a9115a60f15b7796bc717a471d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /delete /tn "Package Cache Launcher" /f
  2⤵
  PID:2028
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /tn "WPD\Package Cache Launcher" /xml "C:\ProgramData\Package Cache\PackageCacheLauncher.xml"
  2⤵
  - Creates scheduled task(s)
  PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\PackageCacheLauncher.xml

Filesize
2KB

MD5
a9ef776e8d3f52914e4b6237c0fc3bb8

SHA1
268cc6efca904c6a64ea3dd548f5b4a2e7e070af

SHA256
7285e35ca4e9d39ddd00dbea8ddd08cb7f3380467c62307c806b3ef6e23e9dc2

SHA512
dea83e692f797ad21c61fffa8bab37e56038e7e16fb2c7e1ddebdeace92a187ca8389e82dab516b8872f70bbb44abecec05ff9d65a67d00b4f39dec3f6d64cfa

Download Submit
memory/1200-133-0x0000000001530000-0x0000000001540000-memory.dmp

Filesize
64KB

Download
memory/1200-134-0x0000000001530000-0x0000000001540000-memory.dmp

Filesize
64KB

Download